{
  "ticket_id": "CVE-2026-9082",
  "code_root": "external/drupal",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-9082",
    "advisory_id": "SA-CORE-2026-004",
    "advisory_url": "https://www.drupal.org/sa-core-2026-004",
    "vendor": "Drupal",
    "product": "Drupal core",
    "repo": "https://git.drupalcode.org/project/drupal"
  },
  "facts": {
    "cve_id": "CVE-2026-9082",
    "advisory_id": "SA-CORE-2026-004",
    "issue_summary": "SQL injection in Drupal core's Entity Query SQL backend. When an entity query condition value is an array, the array keys are used to build named SQL placeholders that are concatenated into raw SQL; attacker-controlled array keys allow arbitrary SQL injection. PostgreSQL-specific.",
    "vulnerability_type": "SQL Injection",
    "suspected_cwe": ["CWE-89"],
    "affected_versions": "8.9.0-<10.4.10, 10.5.0-<10.5.10, 10.6.0-<10.6.9, 11.0.0-<11.1.10, 11.2.0-<11.2.12, 11.3.0-<11.3.10",
    "fixed_versions": ["10.4.10", "10.5.10", "10.6.9", "11.1.10", "11.2.12", "11.3.10"],
    "reproduce_version": "11.3.9",
    "verify_fixed_version": "11.3.10",
    "repo_url": "https://git.drupalcode.org/project/drupal.git",
    "checkout_ref": "11.3.9",
    "code_root": "external/drupal",
    "database_requirement": "PostgreSQL only (does not trigger on MySQL/MariaDB or SQLite)",
    "attacker_access": "anonymous / unauthenticated",
    "primary_entry_point": "JSON:API collection filter query parameters (jsonapi core module)",
    "reproduction_requirement": "MUST exploit via a running Drupal site over real HTTP (anonymous curl to a JSON:API filter endpoint). A PHP harness that calls translateCondition()/compile() directly, mock Select objects, reimplemented logic, or static analysis are NOT acceptable and must be rejected.",
    "patch_diff_command": "git diff 11.3.9 11.3.10",
    "vulnerable_files": [
      "core/modules/pgsql/src/EntityQuery/Condition.php",
      "core/lib/Drupal/Core/Entity/Query/Sql/Condition.php",
      "core/lib/Drupal/Core/Entity/Query/Sql/ConditionAggregate.php"
    ],
    "environment_notes": "Local backend, no Docker. Install natively as root: PostgreSQL (apt), PHP 8.3 with pgsql/gd/xml/mbstring/curl/zip extensions, and Composer. Install Drupal 11.3.9 via composer create-project (pin drupal/core-* to 11.3.9). The PHP built-in server (php -S) is sufficient. Complete a standard site install against PostgreSQL and enable the jsonapi module.",
    "desired_artifacts": [
      "repro/reproduction_steps.sh",
      "repro/rca_report.md",
      "repro/patch_analysis.md",
      "runtime evidence of injected SQL on 11.3.9 and safe handling on 11.3.10"
    ]
  },
  "simulation": {
    "recipe_id": "default_recipe",
    "inputs": {
      "code_root": "external/drupal",
      "install_command": "git clone --depth 1 --branch 11.3.9 https://git.drupalcode.org/project/drupal.git external/drupal",
      "command": "git -C external/drupal diff 11.3.9 11.3.10 -- core/modules/pgsql/src/EntityQuery/Condition.php"
    }
  }
}